ISO 27001 Internal Auditor key terms

The preservation of confidentiality, integrity and availability of information, extended in ISO/IEC 27000 to include authenticity, accountability, non-repudiation and reliability. It is achieved through policies, processes and controls that manage risk to information assets.

The property that information is not made available or disclosed to unauthorized individuals, entities or processes. It is protected by measures such as access control, classification, encryption and need-to-know restrictions.

The property of accuracy and completeness of information and of the systems that process it. It is safeguarded through change control, logging, hashing, reconciliation checks and controlled access to data and configurations.

The property of being accessible and usable on demand by an authorized entity. It is supported by redundancy, backup, capacity management, resilience design and incident response arrangements.

The effect of uncertainty on objectives, usually expressed as a combination of the likelihood of an event and its consequences. In information security it is the potential for loss or harm arising from a threat exploiting a vulnerability.

A potential cause of an unwanted incident that may result in harm to a system, organization or individual. Threats may be deliberate, accidental or environmental, and are assessed for capability and intent.

A weakness of an asset or control that one or more threats can exploit. Vulnerabilities may be technical, procedural, organizational or physical, and are typically identified through assessment, scanning, testing or review.

A process to select and implement options for addressing risk, such as avoiding, reducing, transferring or accepting it. It includes choosing controls and producing a statement of applicability and a treatment plan.

The risk that remains after risk treatment has been applied. It must be compared with the risk acceptance criteria and formally accepted by an accountable owner before the ISMS can be considered effective.

Documented thresholds and conditions that define how much risk the organization is willing to retain, and under what circumstances. They give decision-makers a consistent basis for approving or rejecting residual risk.

The overall process of risk identification, risk analysis and risk evaluation. Within an ISMS it establishes which risks matter, how severe they are and which require treatment, producing a repeatable basis for decisions.

The person or entity accountable for managing a particular risk, including approving treatment and accepting residual risk. The role must have sufficient authority and be clearly recorded in the risk register.

A set of interrelated policies, objectives, processes and controls used to manage information security risk. It is established, implemented, maintained and continually improved within the organization's overall management framework.

The documented boundaries and applicability of the management system, including interfaces and dependencies. It states which organizational units, locations, technologies and information assets are covered and which are excluded, with justification.

A document describing which Annex A controls are applicable, why they are included or excluded, and whether they are implemented. It links risk treatment decisions to the controls actually operating.

The reference control set in ISO/IEC 27001:2022, organized into organizational, people, physical and technological themes. Organizations select relevant controls through risk treatment and record the outcome in the statement of applicability.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Their requirements help determine the scope and obligations of the management system.

The external and internal issues, requirements and influences relevant to the organization's purpose and to the ISMS. Understanding it is a prerequisite for designing a management system that fits actual conditions.

Top management's active involvement in directing and supporting the management system, including establishing policy, providing resources and integrating security into business processes. It cannot be delegated to the security function alone.

A documented statement of top management's direction, principles and objectives for information security. It provides a framework for setting objectives and is communicated, available and reviewed for continuing suitability.

Measurable outcomes the organization intends to achieve for information security. They should be consistent with policy, relevant to requirements, monitored, communicated and updated as circumstances change.

The monitoring, measurement, analysis and evaluation activities used to determine whether the management system is achieving intended results. It includes internal audit results, indicator data and management review inputs.

A periodic, top-management examination of the ISMS to confirm its continuing suitability, adequacy and effectiveness. It considers audit results, risk status, performance data and opportunities for improvement, and produces documented decisions.

The recurring activity of enhancing the management system's performance and effectiveness. It relies on nonconformity correction, analysis of performance data and deliberate action on opportunities identified through review and audit.

A failure to meet a requirement, whether from ISO/IEC 27001, the organization's own ISMS requirements or applicable obligations. It must be analysed, corrected and, where needed, prevented from recurring.

Action taken to eliminate the cause of a nonconformity so it does not recur. It begins with root-cause analysis, includes implementation and verification of effectiveness, and may lead to changes in the management system.

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. It produces findings and conclusions communicated in an audit report.

The set of requirements, policies, procedures or standards used as a reference against which evidence is evaluated. Without agreed criteria an audit cannot reach a defensible conclusion.

Records, statements of fact or other information that is relevant to the audit criteria and verifiable. Evidence is gathered through interviews, observation and document review, and only verifiable evidence can support findings.

Data supporting the existence or truth of something, obtained through observation, measurement, testing or records. Auditors rely on it to distinguish demonstrated performance from assertion or opinion.

The result of evaluating collected evidence against audit criteria. Findings may indicate conformity or nonconformity, and are recorded with supporting evidence so they can be understood and acted upon.

A noted condition or improvement opportunity that does not itself constitute a nonconformity against criteria. It is reported for management attention and may be recorded as an opportunity for improvement.

The arrangements for one or more audits, planned for a specific time frame and directed towards a specific purpose. It defines frequency, methods, responsibilities and resourcing across the audit cycle.

A description of the activities and arrangements for a single audit, including objectives, criteria, scope, schedule, team and sampling approach. It is agreed with the auditee and updated when changes occur.

The extent and boundaries of an audit, such as units, processes, locations, time period and functions covered. It must be consistent with the audit objective and, where relevant, with the ISMS scope.

One or more auditors conducting an audit, supported where needed by technical experts. Members collectively need the competence and impartiality required by the audit scope and criteria.

The demonstrated ability to apply knowledge, skills and personal attributes needed to perform audits. It includes audit principles and methods, management system knowledge, sector understanding and the ability to collect and evaluate evidence.

The freedom from conditions that threaten the auditor's impartiality and objectivity. Auditors should not audit their own work, and any impairment must be identified and managed before conclusions are drawn.

A formal start to the audit in which objectives, criteria, scope, schedule, methods and communication arrangements are confirmed with the auditee. It also clarifies roles, escalation routes and confidentiality expectations.

The formal end of the audit where findings, conclusions and recommendations are presented and understood. It confirms agreement on facts, clarifies any disagreement and sets expectations for the audit report.

The documented output of an audit, covering objectives, scope, criteria, findings, conclusions and, where applicable, recommendations. It provides a durable record that supports corrective action and management review.

Selecting a portion of a population to draw conclusions about the whole. Auditors use sampling to obtain sufficient evidence within time constraints and must be able to explain and justify the approach chosen.

The ability to follow the history, application or location of an item or activity through recorded information. In auditing it lets conclusions be linked back to specific evidence and criteria.

Fulfilment of a requirement. Auditors determine conformity by comparing verifiable evidence with the agreed criteria, and report it explicitly when the audit objective requires a statement on it.

A measure that maintains or modifies risk, including policies, procedures, technical safeguards, organizational practices and physical protections. Controls are selected through risk treatment and verified for implementation and effectiveness.

The determination of whether a control is relevant to the organization's risks and obligations. Decisions on applicability, with justification, are recorded in the statement of applicability.

The planned schedule and arrangements for internal audits of the ISMS, considering the importance of processes, changes and previous results. It must be planned, established, implemented and maintained by the organization.